Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - Civil Service Commission (November 8, 2024)

This is a Massachusetts State Auditor performance audit about whether government workers completed cybersecurity training during the audit period.

“This audit covers the period July 1, 2021 through April 30, 2023 and includes the following agencies:”

The auditor checked whether EOTSS and 22 other public entities followed the state’s cybersecurity training rules.

“Pursuant to our governing statute, Section 12 of Chapter 11 of the General Laws, our audit covers multiple entities’ compliance with EOTSS’s cybersecurity training standards.”

Missed cybersecurity training can leave agencies more vulnerable to cyberattacks, money losses, and damage to public trust.

“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

Cybersecurity training helps protect state systems and data used to deliver public services to residents, businesses, motorists, families, and others.

“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”

The audit’s answer was no: the reviewed entities did not all make sure their employees completed the required training.

“Did EOTSS and other executive branch agencies, state colleges and universities, and regional transit authorities ensure that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010?”

The auditor recommended stronger tracking, better onboarding controls, required training for all employees, and consequences when training is not completed.

“The aforementioned three regional transit authorities should do the following:”

This was not a single-office issue; the report covered EOTSS plus executive branch agencies, public colleges and universities, and regional transit authorities across Massachusetts.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Executive Office of Technology Services and Security (EOTSS), as well as 22 other executive branch agencies, state colleges and universities, and regional transit authorities.”

“Cybersecurity awareness training” means teaching employees their role in protecting government information from being exposed, unavailable, or changed improperly.

“The objective of the Commonwealth information security training is to educate users on their responsibility to help protect the confidentiality, availability and integrity of the Commonwealth’s information assets.”